Is CVE-2026-123802 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-123802 being exploited in the wild.

How severe is CVE-2026-123802?

High severity, with a CVSS score of 8.1, published 9 November 2026.

Which products and versions are affected?

Supertokens Core 11.3.0 through 11.3.7, 11.4.0 through 11.4.7, 12.0.0 through 12.0.10, 12.1.0 through 12.1.1, 12.2.0, 12.3.0.

Is there a fix for CVE-2026-123802?

Yes: fixed in 11.3.8, 11.4.8, 12.0.11, 12.1.2, 12.2.1, 12.3.1. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-123802 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-123802?

Check whether you run Supertokens Core at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-123802: SuperTokens Core SAML authentication bypass

CVE-2026-123802 · Severity: high · CVSS 8.1 · Published 2026-11-09

SuperTokens Core is an open source authentication server used to manage user identity and access. A flaw in SAML authentication allows an attacker to authenticate as a victim user either by combining assertions from different identity providers or by reusing assertions intended for other deployments. Successful exploitation grants the attacker unauthorized access to accounts they do not own.

Technologies: Supertokens Core. Vendors: Supertokens.

Quick answers

Is CVE-2026-123802 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-123802 being exploited in the wild.
How severe is CVE-2026-123802?: High severity, with a CVSS score of 8.1, published 9 November 2026.
Which products and versions are affected?: Supertokens Core 11.3.0 through 11.3.7, 11.4.0 through 11.4.7, 12.0.0 through 12.0.10, 12.1.0 through 12.1.1, 12.2.0, 12.3.0.
Is there a fix for CVE-2026-123802?: Yes: fixed in 11.3.8, 11.4.8, 12.0.11, 12.1.2, 12.2.1, 12.3.1. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-123802 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-123802?: Check whether you run Supertokens Core at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 11.3.8, 11.4.8, 12.0.11, 12.1.2, 12.2.1, 12.3.1

Technical details

The vulnerability exists in SAML response validation: validateSamlResponseAudience accepts an audience from one assertion while extractAllClaims extracts the NameID and attributes from another, allowing assertion mixing when the identity provider uses assertion-level signing. Additionally, a shared default saml_sp_entity_id value across deployments permits an assertion issued to one SuperTokens deployment to satisfy the audience check at another. Response-level signing provides some mitigation against the multi-assertion attack but not the cross-deployment attack.

Affected products

SuperTokens Core 11.3.0 through 11.3.7, 11.4.0 through 11.4.7, 12.0.0 through 12.0.10, 12.1.0 through 12.1.1, 12.2.0, 12.3.0

Timeline

2026-11-09: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.